W3C home > Mailing lists > Public > whatwg@whatwg.org > October 2014

Re: [whatwg] Proposal: Write-only submittable form-associated controls.

From: Mike West <mkwst@google.com>
Date: Wed, 15 Oct 2014 18:43:31 +0200
Message-ID: <CAKXHy=e7mC-sZGztYCYNLbyOYns91AqpSNSSUzHkPT1sSuH=7A@mail.gmail.com>
To: "Tab Atkins Jr." <jackalmage@gmail.com>
Cc: WHAT Working Group Mailing List <whatwg@whatwg.org>, Jonas Sicking <jonas@sicking.cc>
On Wed, Oct 15, 2014 at 6:10 PM, Tab Atkins Jr. <jackalmage@gmail.com>
wrote:

>
> Nothing in-band will work, because the attacker can replace arbitrary
> amounts of the page if they're loaded as an in-page script.  It's
> gotta be *temporally* isolated - either something out-of-band like a
> response header, or something that has no effect by the time scripts
> run, like a <meta> that is only read during initial parsing.
>

Yes. Hence the CSP directive portion of the proposal.

The inline attribute is useful for the specific password manager case I'm
concentrating on, as it gives us a clear indication that the site doesn't
intend to do wacky manipulation of its credentials on the fly. We can use
this to determine how and when the password manager (or credit card
autofill, or whatever) ought to refuse to expose information to the
renderer.

--
Mike West <mkwst@google.com>
Google+: https://mkw.st/+, Twitter: @mikewest, Cell: +49 162 10 255 91

Google Germany GmbH, Dienerstrasse 12, 80331 München, Germany
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
Geschäftsführer: Graham Law, Christine Elizabeth Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)
Received on Wednesday, 15 October 2014 16:44:18 UTC

This archive was generated by hypermail 2.4.0 : Wednesday, 22 January 2020 17:00:24 UTC